{"id":79857,"date":"2026-07-21T14:45:28","date_gmt":"2026-07-21T14:45:28","guid":{"rendered":"https:\/\/owncloud.com\/?p=79857"},"modified":"2026-07-21T14:45:28","modified_gmt":"2026-07-21T14:45:28","slug":"ocis-8-0-5-and-8-0-6-a-month-of-patches-on-the-curie-series","status":"publish","type":"post","link":"https:\/\/owncloud.com\/de\/blogs\/ocis-8-0-5-and-8-0-6-a-month-of-patches-on-the-curie-series\/","title":{"rendered":"oCIS 8.0.5 and 8.0.6: A Month of Patches on the Curie Series"},"content":{"rendered":"<p>Release dates: 19 June 2026 (<a href=\"https:\/\/github.com\/owncloud\/ocis\/releases\/tag\/v8.0.5\" target=\"_blank\" rel=\"noopener\">8.0.5<\/a>) and 17 July 2026 (<a href=\"https:\/\/github.com\/owncloud\/ocis\/releases\/tag\/v8.0.6\" target=\"_blank\" rel=\"noopener\">8.0.6<\/a>) \u00b7 Repository: <a href=\"https:\/\/github.com\/owncloud\/ocis\" target=\"_blank\" rel=\"noopener\">owncloud\/ocis<\/a><br \/>\nGitHub releases: <a href=\"https:\/\/github.com\/owncloud\/ocis\/releases\/tag\/v8.0.5\" target=\"_blank\" rel=\"noopener\">v8.0.5<\/a> \u00b7 <a href=\"https:\/\/github.com\/owncloud\/ocis\/releases\/tag\/v8.0.6\" target=\"_blank\" rel=\"noopener\">v8.0.6<\/a><\/p>\n<p>Two consecutive patches on the 8.0.x (&#8222;<a href=\"https:\/\/owncloud.com\/blogs\/ocis-curie-is-complete-and-you-should-update-to-8-0-3-now\/\">Curie<\/a>&#8222;) series. Between them: two Go standard-library CVEs that surfaced through the release image security scan, two libvips refreshes triggered by Alpine repository churn, one very important NATS reliability fix, and one long-requested opt-out for LDAP sign-in write amplification. If you&#8217;re running any 8.0.x deployment, this recap covers what changed since 8.0.4.<\/p>\n<h2>Summary across both releases<\/h2>\n<ul>\n<li><strong>Two Go CVEs closed.<\/strong> <a href=\"https:\/\/github.com\/advisories\/GHSA-h524-452v-82p9\" target=\"_blank\" rel=\"noopener\">CVE-2026-42504<\/a> (High, CVSS 7.5, MIME header DoS) in 8.0.5, and <a href=\"https:\/\/github.com\/advisories\/GHSA-xcgv-8mv7-v8c7\" target=\"_blank\" rel=\"noopener\">CVE-2026-39822<\/a> (High, CVSS 7.8, symlink following in Root) in 8.0.6.<\/li>\n<li><strong>Two libvips refreshes.<\/strong>18.2-r0 \u2192 8.18.3 \u2192 8.18.4, both triggered by Alpine edge\/community package churn rather than upstream vulnerabilities.<\/li>\n<li><strong>Two operationally significant bugfixes.<\/strong> The Education user delete endpoint now actually deletes users. The NATS KV store now recovers automatically after a NATS restart.<\/li>\n<li><strong>One long-requested opt-out.<\/strong> OCIS_LDAP_UPDATE_LAST_SIGNIN_DATE=false lets you stop the graph service from writing oCLastSignInTimestamp on every sign-in.<\/li>\n<\/ul>\n<p>Both releases are drop-in patches. No schema migrations. No config changes required unless you choose to set the new LDAP flag.<\/p>\n<h2>8.0.5 (19 June 2026)<\/h2>\n<p><strong>Go toolchain 1.25.10 \u2192 1.25.11 (<\/strong><a href=\"https:\/\/github.com\/advisories\/GHSA-h524-452v-82p9\" target=\"_blank\" rel=\"noopener\"><strong>CVE-2026-42504<\/strong><\/a><strong>, <\/strong><a href=\"https:\/\/github.com\/owncloud\/ocis\/pull\/12446\" target=\"_blank\" rel=\"noopener\"><strong>PR #12446<\/strong><\/a><strong>)<\/strong><\/p>\n<p>The release image scan flagged a denial-of-service vulnerability in Go&#8217;s net\/textproto MIME header decoder (High severity, CVSS 7.5, CWE-407 Inefficient Algorithmic Complexity). A maliciously crafted MIME header with many invalid encoded-words can consume excessive CPU. Because MIME headers reach oCIS through HTTP and WebDAV request paths, this is a realistic attack surface for a file sync and share platform. Go 1.25.11 resolves it at the runtime level; no application code changes were required.<\/p>\n<p><strong>libvips 8.18.2-r0 \u2192 8.18.3 (<\/strong><a href=\"https:\/\/github.com\/owncloud\/ocis\/pull\/12446\" target=\"_blank\" rel=\"noopener\"><strong>PR #12446<\/strong><\/a><strong>)<\/strong><\/p>\n<p>The pinned libvips version got pulled from the Alpine edge\/community repository, breaking fresh Docker image builds. Bumped to 8.18.3 to restore builds. libvips underpins thumbnail and preview generation in oCIS.<\/p>\n<p><strong>Education user delete now actually deletes users (<\/strong><a href=\"https:\/\/github.com\/owncloud\/ocis\/pull\/12395\" target=\"_blank\" rel=\"noopener\"><strong>PR #12395<\/strong><\/a><strong>)<\/strong><\/p>\n<p>DELETE \/graph\/v1.0\/education\/users\/{id} had been returning a 404 without removing the user from the LDAP directory. Callers received a response that looked like the user had been removed; the LDAP entry stayed put. Deployments using the Graph API to manage student and staff accounts had been accumulating orphaned LDAP entries since oCIS 8.0.<\/p>\n<p>Root cause: the education-user delete handler passed user.GetExternalID() to the LDAP backend&#8217;s DELETE operation, while the regular \/users handler and the pre-8.0 code path both used user.GetId(). With the default configuration (RequireExternalID=false), the LDAP backend resolves users by name or UUID, not by external ID. The lookup never matched, so the backend returned not-found. The fix aligns the education delete handler with the working code path.<\/p>\n<p><strong>NATS KV store now recovers after connection loss (<\/strong><a href=\"https:\/\/github.com\/owncloud\/ocis\/pull\/12401\" target=\"_blank\" rel=\"noopener\"><strong>PR #12401<\/strong><\/a><strong>)<\/strong><\/p>\n<p>The most operationally significant fix in this pair of releases. In Kubernetes deployments where NATS runs as a pod, a NATS restart longer than the client&#8217;s reconnect window used to leave affected oCIS services in a permanently broken state with no self-healing and no clear signal that anything was wrong.<\/p>\n<p>Technical detail: the nats-js-kv go-micro store plugin&#8217;s hasConn() method checked only whether the connection object was non-nil. NATS client connections that exhaust their reconnect attempts become permanently closed while the object remains non-nil. Because initialization was gated on !hasConn(), and hasConn() returned true for the dead connection, re-initialization never ran. Every subsequent KV operation failed with nats: connection closed until a human manually restarted the affected oCIS pod.<\/p>\n<p>The user-visible symptoms were severe:<\/p>\n<ul>\n<li><strong>All spaces disappeared.<\/strong> ListStorageSpaces in storage-users relies on the NATS KV cache. With a dead connection it couldn&#8217;t serve space listings, so users saw an empty file browser.<\/li>\n<li><strong>Downloads failed.<\/strong> The ocs service retrieves signing keys from the NATS KV store. A permanently dead store meant keys couldn&#8217;t be found and download requests failed.<\/li>\n<\/ul>\n<p>The fix: hasConn() now also checks whether the connection is still alive. A closed connection is treated as equivalent to no connection, so the next KV operation transparently re-initialises. No manual pod restart required.<\/p>\n<p>The same fix was carried into <a href=\"https:\/\/owncloud.com\/blogs\/owncloud-infinite-scale-8-1-0-mfa-gated-vault-storage-arrives\/\">oCIS 8.1.0<\/a> as PR #12402.<\/p>\n<h2>8.0.6 (17 July 2026)<\/h2>\n<p><strong>Go toolchain 1.25.11 \u2192 1.25.12 (<\/strong><a href=\"https:\/\/github.com\/advisories\/GHSA-xcgv-8mv7-v8c7\" target=\"_blank\" rel=\"noopener\"><strong>CVE-2026-39822<\/strong><\/a><strong>, <\/strong><a href=\"https:\/\/github.com\/owncloud\/ocis\/pull\/12602\" target=\"_blank\" rel=\"noopener\"><strong>PR #12602<\/strong><\/a><strong>)<\/strong><\/p>\n<p>Another Go standard-library CVE flagged by the release image scan (High severity, CVSS 7.8, CWE-61 UNIX Symbolic Link Following). Opening a file in an os.Root can improperly follow symlinks to locations outside the sandboxed root when the final path component is a symbolic link and the path ends in \/. oCIS doesn&#8217;t necessarily use every corner of that API directly, but the release binaries and Docker images are built with the affected toolchain, and that was enough to hold the release. Go 1.25.12 resolves it.<\/p>\n<p><strong>libvips 8.18.3-r0 \u2192 8.18.4 (<\/strong><a href=\"https:\/\/github.com\/owncloud\/ocis\/pull\/12596\" target=\"_blank\" rel=\"noopener\"><strong>PR #12596<\/strong><\/a><strong>)<\/strong><\/p>\n<p>Same Alpine repo churn as before, one version later. 8.18.3-r0 got dropped from edge\/community; 8.18.4 restores builds. If you pull the official Docker images, this is transparent.<\/p>\n<p><strong>Opt-out for LDAP sign-in write amplification (<\/strong><a href=\"https:\/\/github.com\/owncloud\/ocis\/pull\/12522\" target=\"_blank\" rel=\"noopener\"><strong>PR #12522<\/strong><\/a><strong>, building on earlier work in <\/strong><a href=\"https:\/\/github.com\/owncloud\/ocis\/pull\/9942\" target=\"_blank\" rel=\"noopener\"><strong>PR #9942<\/strong><\/a><strong>)<\/strong><\/p>\n<p>The graph service updates the oCLastSignInTimestamp LDAP attribute on every sign-in. On paper this is a nice-to-have audit field. In practice, if your LDAP backend has write access enabled and your proxy&#8217;s OIDC userinfo cache has a short TTL, sign-in events fire often and every one of them turns into an LDAP write. For large LDAP-backed user bases with short-lived OIDC caches, that adds up to real write amplification for very little operational benefit.<\/p>\n<p>8.0.6 adds OCIS_LDAP_UPDATE_LAST_SIGNIN_DATE (or the graph-scoped GRAPH_LDAP_UPDATE_LAST_SIGNIN_DATE), defaulting to true. Set it to false and the graph service stops listening for UserSignedIn events entirely and never touches the attribute. This is a narrower lever than turning off OCIS_LDAP_SERVER_WRITE_ENABLED wholesale or disabling the graph events consumer, so every other LDAP write path (group sync, provisioning, whatever else you rely on) stays intact while only this one chatty update is cut.<\/p>\n<h2>Upgrade<\/h2>\n<p>Both releases are drop-in replacements for any earlier 8.0.x deployment. No schema migrations. No breaking changes.<\/p>\n<ul>\n<li>If you run the official Docker images, the Go and libvips bumps arrive automatically. Pull the new tag.<\/li>\n<li>If you build from source, make sure your pipeline picks up Go 1.25.12 (or newer).<\/li>\n<li>If you run at a scale where sign-in volume produces noticeable LDAP write load, consider setting OCIS_LDAP_UPDATE_LAST_SIGNIN_DATE=false on the 8.0.6 upgrade.<\/li>\n<li>The NATS KV recovery fix in 8.0.5 is fully automatic once you&#8217;re on 8.0.5 or later. Nothing to configure.<\/li>\n<\/ul>\n<p>Full changelogs and download assets:<\/p>\n<ul>\n<li><a href=\"https:\/\/github.com\/owncloud\/ocis\/releases\/tag\/v8.0.5\" target=\"_blank\" rel=\"noopener\">0.5 release notes<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/owncloud\/ocis\/releases\/tag\/v8.0.6\" target=\"_blank\" rel=\"noopener\">0.6 release notes<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/owncloud\/ocis\/releases\" target=\"_blank\" rel=\"noopener\">oCIS releases page<\/a> for the full history<\/li>\n<\/ul>\n<p>Two consecutive patches, no drama, no downtime for the platform. That&#8217;s what patching an actively supported series should feel like: security fixed quietly, reliability improved without ceremony, everything else exactly as it was.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>oCIS 8.0.5 and 8.0.6 recap: two Go CVEs closed, NATS KV store now self-heals after connection loss, education user delete now actually deletes, and LDAP sign-in write amplification has an off switch. Drop-in upgrades.<\/p>\n","protected":false},"author":7,"featured_media":79858,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"categories":[509,339,55,354,360],"tags":[],"class_list":["post-79857","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-infinite-scale","category-owncloud","category-owncloud-product","category-release","category-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/posts\/79857","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/comments?post=79857"}],"version-history":[{"count":2,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/posts\/79857\/revisions"}],"predecessor-version":[{"id":79860,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/posts\/79857\/revisions\/79860"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/media\/79858"}],"wp:attachment":[{"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/media?parent=79857"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/categories?post=79857"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/owncloud.com\/de\/wp-json\/wp\/v2\/tags?post=79857"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}